invalid_client (401 unauthorized) error coming while migrating to new client credential api

[kejul-vyas-mck]

Title: Invalid_Client (401 Unauthorized) error coming from https://secure.soundcloud.com/oauth/token API

Issue found of: Oct 23th, 2024

Endpoint(s):

• POST https://secure.soundcloud.com/oauth/token

Scope(s):

application is uses client_credentials workflow for authentication

Steps to reproduce:

curl --location 'https://secure.soundcloud.com/oauth/token' \
--header 'accept: application/json; charset=utf-8' \
--header 'Content-Type: application/x-www-form-urlencoded' \
--header 'Authorization: Basic Base64(client_id:client_secret)' \
--data-urlencode 'grant_type=client_credentials'

Expected behaviour:

It should return access_token, refresh_token along with other parameters as per the documentation here - https://developers.soundcloud.com/docs/api/guide#client-creds

Actual behaviour:

401 Unauthorized error

[youssefhassan]

Hey @kejul-vyas-mck, my suspicion would be around whether the Base64 is done properly, it can be confusing.

The Base64 encoded string of "my_client_id:my_client_secret" is "bXlfY2xpZW50X2lkOm15X2NsaWVudF9zZWNyZXQ="

Please let us know if this was the issue or otherwise we are happy to assist further.

[kejul-vyas-mck]

Thank you @youssefhassan for looking into this. The Base64 encoded string was able to resolve the issue and it generated the access_token and refresh_token.

However, when I am calling the upload track api (https://api.soundcloud.com/tracks) with the generated access_token, I am unable to upload the audio. It gives Unauthorized 401 error.

Upload track api request I followed from the documentation - https://developers.soundcloud.com/docs/api/guide#uploading-files

[youssefhassan]

Can you please share your soundcloud username and application name so I can debug the issue?
thanks for reporting :)

[youssefhassan]

I deleted the message as it had the client id that can be misused, I will look into the issue soon. From the configuration, it looks that with a valid token, you should be able to make requests to the public api. Is it only giving 401 on track uploads or other endpoints as well?

[mgoodfellow]

Hi,

It seems like you are requesting a client_credential grant - this doesn't have a user context associated with it and it can only be used for GET operations on "public" endpoints, such as /tracks or /track/{id} etc.

In order to make mutations to user data, you need to go through the OAuth connect flow and authorize a specific user context against your app via the connect with soundcloud web flow. Then you can make requests to user context endpoints (/me) and also perform mutations, such as uploading/editing tracks/playlists etc with the OAuth token generated from this.

https://developers.soundcloud.com/docs/api/guide#authentication

You are looking for the Authorization Code Flow, not the Client Credentials Token Exchange Flow

Hope this helps!

[kejul-vyas-mck]

@mgoodfellow The Authentication workflow works now with @youssefhassan's given solution (needed to encrypt the clientid:clientsecret to base64 encoded string).

@youssefhassan the access_token isn't working with any of the SoundCloud api. I tried checking below api to get list of tracks uploaded -

[youssefhassan]

This shouldn't be the case, I'm thinking if the token could have been expired or the client credentials were revoked. Can you please let us know which user the app is attached to and the name of the app?

[kejul-vyas-mck]

@youssefhassan I have always used unexpired tokens. Also, the client credentials and upload tracks API work perfectly fine with the generated access_token from the old URL https://api.soundcloud.com/oauth2/token Only the access_token generated from the new API URL - https://secure.soundcloud.com/oauth/token doesn't work

please find the user and app details below:
user email id - [email protected]
name of the app - https://soundcloud.com/mckinsey

[kejul-vyas-mck]

@youssefhassan, are there any findings from your end?

[kejul-vyas-mck]

@youssefhassan following up on this issue - do we have any solution?